Organizational Control: Incident Response Testing
| Control ID: IR-3 Incident Response Testing | Family: Incident Response | Source: NIST 800-53r4 |
| Control: The organization tests the incident response capability for the information system [Assignment: organization-defined frequency] using [Assignment: organization-defined tests] to determine the incident response effectiveness and documents the results. | ||
| Supplemental Guidance: Organizations test incident response capabilities to determine the overall effectiveness of the capabilities and to identify potential weaknesses or deficiencies. Incident response testing includes, for example, the use of checklists, walk-through or tabletop exercises, simulations (parallel/full interrupt), and comprehensive exercises. Incident response testing can also include a determination of the effects on organizational operations (e.g., reduction in mission capabilities), organizational assets, and individuals due to incident response. Related Controls: CP-4, IR-8 |
||
| Control Enhancements:
(2) Incident Response Testing | Coordination With Related Plans The organization coordinates incident response testing with organizational elements responsible for related plans. Supplemental Guidance: Organizational plans related to incident response testing include, for example, Business Continuity Plans, Contingency Plans, Disaster Recovery Plans, Continuity of Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, and Occupant Emergency Plans. Related Controls: N/A |
||
| References: NIST Special Publications 800-84, 800-115. | ||
| Mechanisms:
|
||
| Protocol Implementation Conformance Statements: N/A | ||